Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 2278e7f

Browse files
author
Stephan Brandauer
committed
CWE 830 polish error messages
1 parent 8233039 commit 2278e7f

3 files changed

Lines changed: 19 additions & 19 deletions

File tree

‎javascript/ql/src/Security/CWE-830/FunctionalityFromUntrustedSource.qhelp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,15 +49,15 @@
4949

5050
<example>
5151
<p>
52-
The following sample loads the jQuery library from the jQuery CDN without using <code>https</code>
52+
The following example loads the jQuery library from the jQuery CDN without using <code>https</code>
5353
and without checking subresource integrity.
5454
</p>
5555

5656
<sample src="jquery-http-nocheck.html" />
5757

5858
<p>
5959
Instead, loading jQuery from the same domain using <code>https</code> and checking
60-
subresource integrity is recommended, as in the next sample.
60+
subresource integrity is recommended, as in the next example.
6161
</p>
6262

6363
<sample src="jquery-https-check.html" />

‎javascript/ql/src/Security/CWE-830/FunctionalityFromUntrustedSource.ql‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -42,11 +42,12 @@ module StaticCreation {
4242
predicate isCdnUrlWithCheckingRequired(string url) {
4343
// Some CDN URLs are required to have an integrity attribute. We only add CDNs to that list
4444
// that recommend integrity-checking.
45-
url.regexpMatch("(?i)" +
45+
url.regexpMatch("(?i)^https?://" +
4646
[
47-
"^https?://code\\.jquery\\.com/.*\\.js$", "^https?://cdnjs\\.cloudflare\\.com/.*\\.js$",
48-
"^https?://cdnjs\\.com/.*\\.js$"
49-
])
47+
"code\\.jquery\\.com", //
48+
"cdnjs\\.cloudflare\\.com", //
49+
"cdnjs\\.com" //
50+
] + "/.*\\.js$")
5051
}
5152

5253
/** A script element that refers to untrusted content. */
@@ -56,9 +57,7 @@ module StaticCreation {
5657
isUntrustedSourceUrl(super.getSourcePath())
5758
}
5859

59-
override string getProblem() {
60-
result = "HTML script element loaded using unencrypted connection."
61-
}
60+
override string getProblem() { result = "Script loaded using unencrypted connection." }
6261
}
6362

6463
/** A script element that refers to untrusted content. */
@@ -77,9 +76,7 @@ module StaticCreation {
7776
class IframeElementWithUntrustedContent extends AddsUntrustedUrl instanceof HTML::IframeElement {
7877
IframeElementWithUntrustedContent() { isUntrustedSourceUrl(super.getSourcePath()) }
7978

80-
override string getProblem() {
81-
result = "HTML iframe element loaded using unencrypted connection."
82-
}
79+
override string getProblem() { result = "Iframe loaded using unencrypted connection." }
8380
}
8481
}
8582

@@ -153,14 +150,17 @@ module DynamicCreation {
153150
string name;
154151

155152
IframeOrScriptSrcAssignment() {
153+
name = ["script", "iframe"] and
156154
exists(DataFlow::Node n | n.asExpr() = this |
157155
isAssignedToSrcAttribute(name, n) and
158156
n = urlTrackedFromUnsafeSourceLiteral()
159157
)
160158
}
161159

162160
override string getProblem() {
163-
result = "HTML " + name + " element loaded using unencrypted connection."
161+
name = "script" and result = "Script loaded using unencrypted connection."
162+
or
163+
name = "iframe" and result = "Iframe loaded using unencrypted connection."
164164
}
165165
}
166166
}

‎javascript/ql/test/query-tests/Security/CWE-830/FunctionalityFromUntrustedSource.expected‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
1-
| DynamicCreationOfUntrustedSourceUse.html:19:28:19:129 | ('https ... /ga.js' | HTML script element loaded using unencrypted connection. |
2-
| DynamicCreationOfUntrustedSourceUse.html:23:26:23:50 | 'http:/ ... e.com/' | HTML iframe element loaded using unencrypted connection. |
3-
| DynamicCreationOfUntrustedSourceUse.html:34:27:34:40 | getUrl('v123') | HTML iframe element loaded using unencrypted connection. |
4-
| DynamicCreationOfUntrustedSourceUse.html:38:41:38:76 | 'http:/ ... e.html' | HTML iframe element loaded using unencrypted connection. |
5-
| StaticCreationOfUntrustedSourceUse.html:6:9:6:56 | <script>...</> | HTML script element loaded using unencrypted connection. |
6-
| StaticCreationOfUntrustedSourceUse.html:9:9:9:58 | <iframe>...</> | HTML iframe element loaded using unencrypted connection. |
1+
| DynamicCreationOfUntrustedSourceUse.html:19:28:19:129 | ('https ... /ga.js' | Script loaded using unencrypted connection. |
2+
| DynamicCreationOfUntrustedSourceUse.html:23:26:23:50 | 'http:/ ... e.com/' | Iframe loaded using unencrypted connection. |
3+
| DynamicCreationOfUntrustedSourceUse.html:34:27:34:40 | getUrl('v123') | Iframe loaded using unencrypted connection. |
4+
| DynamicCreationOfUntrustedSourceUse.html:38:41:38:76 | 'http:/ ... e.html' | Iframe loaded using unencrypted connection. |
5+
| StaticCreationOfUntrustedSourceUse.html:6:9:6:56 | <script>...</> | Script loaded using unencrypted connection. |
6+
| StaticCreationOfUntrustedSourceUse.html:9:9:9:58 | <iframe>...</> | Iframe loaded using unencrypted connection. |
77
| StaticCreationOfUntrustedSourceUse.html:21:9:21:155 | <script>...</> | Script loaded from content delivery network with no integrity check. |

0 commit comments

Comments
 (0)